diff --git a/.github/scripts/Build-Deps-Windows.ps1 b/.github/scripts/Build-Deps-Windows.ps1
index a9c2138e..416d9363 100644
--- a/.github/scripts/Build-Deps-Windows.ps1
+++ b/.github/scripts/Build-Deps-Windows.ps1
@@ -237,6 +237,21 @@ function Build {
         "-DPAHO_WITH_SSL=ON"
     )
 
+    # Try to find OpenSSL installed via winget
+    $pf64 = Join-Path $Env:ProgramFiles "OpenSSL-Win64"
+    $pf = Join-Path $Env:ProgramFiles "OpenSSL"
+    $possibleDirs = @($pf64, $pf)
+    $opensslDir = $possibleDirs | Where-Object { Test-Path (Join-Path $_ "include\openssl\ssl.h") } | Select-Object -First 1
+
+    if ($opensslDir) {
+        Write-Host "Detected OpenSSL at: $opensslDir"
+        $MqttCmakeArgs += "-DOPENSSL_ROOT_DIR=$opensslDir"
+        $MqttCmakeArgs += "-DOPENSSL_CRYPTO_LIBRARY=$opensslDir\lib\VC\x64\MD\libcrypto.lib"
+        $MqttCmakeArgs += "-DOPENSSL_SSL_LIBRARY=$opensslDir\lib\VC\x64\MD\libssl.lib"
+    } else {
+        Write-Warning "OpenSSL not found - maybe cmake will find it ..."
+    }
+
     Log-Information "Configuring paho.mqtt.cpp..."
     Invoke-External cmake -S ${MqttPath} -B ${MqttBuildPath} @MqttCmakeArgs
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 7c17297d..4b898cbd 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -34,6 +34,11 @@ include(cmake/common/get_git_revision_description.cmake)
 get_git_head_revision(GIT_REFSPEC GIT_SHA1)
 git_describe(GIT_TAG)
 
+# Helper for OpenSSL
+if(OS_WINDOWS)
+  include(cmake/windows/wingetssl.cmake)
+endif()
+
 if(${GIT_TAG} STREQUAL "GIT-NOTFOUND")
   set(GIT_TAG ${PROJECT_VERSION})
 endif()
diff --git a/cmake/windows/wingetssl.cmake b/cmake/windows/wingetssl.cmake
new file mode 100644
index 00000000..04966e42
--- /dev/null
+++ b/cmake/windows/wingetssl.cmake
@@ -0,0 +1,78 @@
+# ---------------------------------------------------------------------------
+# Detects OpenSSL installed via winget or other common Windows locations,
+# without requiring the user to manually set OPENSSL_ROOT_DIR.
+# ---------------------------------------------------------------------------
+
+if(WIN32 AND (NOT OpenSSL_FOUND))
+
+  set(_openssl_roots
+      "$ENV{ProgramFiles}/OpenSSL-Win64" "$ENV{ProgramFiles}/OpenSSL"
+      "$ENV{ProgramW6432}/OpenSSL-Win64")
+
+  set(_openssl_lib_suffixes "lib/VC/x64/MD" "lib/VC/x64/MDd" "lib/VC/x64/MT"
+                            "lib/VC/x64/MTd" "lib")
+
+  # Determine which configuration we're building
+  if(CMAKE_BUILD_TYPE MATCHES "Debug")
+    set(_is_debug TRUE)
+  else()
+    set(_is_debug FALSE)
+  endif()
+
+  # Determine which runtime we use Default to /MD (shared CRT)
+  set(_crt_kind "MD")
+  if(MSVC)
+    if(CMAKE_MSVC_RUNTIME_LIBRARY MATCHES "MultiThreaded")
+      if(CMAKE_MSVC_RUNTIME_LIBRARY MATCHES "Debug")
+        set(_crt_kind "MTd")
+      else()
+        set(_crt_kind "MT")
+      endif()
+    else()
+      if(_is_debug)
+        set(_crt_kind "MDd")
+      else()
+        set(_crt_kind "MD")
+      endif()
+    endif()
+  endif()
+
+  message(STATUS "Looking for OpenSSL built with CRT variant: ${_crt_kind}")
+
+  # Try to find the root and corresponding lib path
+  foreach(_root ${_openssl_roots})
+    if(EXISTS "${_root}/include/openssl/ssl.h")
+      foreach(_suffix ${_openssl_lib_suffixes})
+        if(_suffix MATCHES "${_crt_kind}$"
+           AND EXISTS "${_root}/${_suffix}/libcrypto.lib")
+          set(OPENSSL_ROOT_DIR
+              "${_root}"
+              CACHE PATH "Path to OpenSSL root")
+          set(OPENSSL_CRYPTO_LIBRARY
+              "${_root}/${_suffix}/libcrypto.lib"
+              CACHE FILEPATH "OpenSSL crypto lib")
+          set(OPENSSL_SSL_LIBRARY
+              "${_root}/${_suffix}/libssl.lib"
+              CACHE FILEPATH "OpenSSL ssl lib")
+          set(OPENSSL_INCLUDE_DIR
+              "${_root}/include"
+              CACHE PATH "OpenSSL include dir")
+          set(OpenSSL_FOUND
+              TRUE
+              CACHE BOOL "Whether OpenSSL was found")
+          message(STATUS "Found OpenSSL at: ${_root}/${_suffix}")
+          return()
+        endif()
+      endforeach()
+    endif()
+    if(OpenSSL_FOUND)
+      break()
+    endif()
+  endforeach()
+
+  if(NOT OpenSSL_FOUND)
+    message(WARNING "Could not auto-detect OpenSSL under Program Files. "
+                    "Might have to set OPENSSL_ROOT_DIR manually.")
+  endif()
+
+endif()